Privacy Policy

Last updated: Sep 10 2026

Time to Talk SLT (“we”, “us”, “our”) provides speech and language therapy and autism assessment services. This policy explains what personal data we collect through our website, our clinical services, and our online shop, why we collect it, how long we keep it, and what rights you have over it.

This policy should be read alongside our separate Cookie Policy.

1. Who we are

Time to Talk SLT is operated by “Ahlem Birem, trading as Time to Talk SLT”.

  • Address: 1st Floor, 5 O’Connell St, Burgagery-Lands West, Clonmel, Co. Tipperary, E91 EY44, Ireland
  • Phone: 083 159 9064
  • Email: info@timetotalkslt.com
  • Clinician registration: Ahlem Birem, CORU Reg. SL041526, IASLT Member

time to talk slt is the data controller for the personal data described in this policy.

2. The personal data we collect

Depending on how you interact with us, we may collect:

  • Enquiry and contact data — name, email, phone number, and the content of any message you send via our contact form or by email/phone.
  • Appointment and booking data — name, contact details, and appointment scheduling information submitted through book an appointment or contact form.
  • Clinical and assessment data — see Section 3 below.
  • Shop / order data — if you buy resources through our shop, WooCommerce collects your name, billing and delivery address, email, phone number, order history, and payment status (card details themselves are processed by our payment provider stripe.
  • Account data — if you create an account on the site, your username, email, and order history.
  • Website usage data — collected through cookies and Google Analytics, including pages visited, approximate location, device/browser type, and referral source. See our Cookie Policy for full details.
  • Comments — if you leave a blog comment, we collect the content of the comment, your IP address, and browser user-agent to help with spam detection, and may check an anonymised hash of your email against Gravatar.

3. Special category (health) data we process

As a clinical practice, we process health data, which GDPR classifies as a “special category” requiring extra protection. This includes, where relevant to your (or your child’s) care:

  • Referral and background information (e.g. developmental, medical, or educational history)
  • Assessment results, screening and standardised test scores
  • Clinical notes, therapy plans, and progress records
  • Reports written for you, schools, GPs, or other professionals (only shared with your consent, or another lawful basis — see Section 4)
  • Information disclosed during sessions relevant to assessment or treatment

We only collect the clinical information necessary to assess and support the person receiving therapy.

4. Why we process your data, and our legal basis

Purpose Data used Legal basis (GDPR Art. 6) Special category basis (GDPR Art. 9), where relevant
Responding to enquiries Contact form/email data Art. 6(1)(f) legitimate interests (responding to enquiries) —
Booking and delivering appointments Booking and clinical data Art. 6(1)(b) performance of a contract for services Art. 9(2)(h), health/social care treatment provided by a registered health professional, given effect in Irish law by Data Protection Act 2018, s.52
Clinical assessment, therapy, and record-keeping Clinical/assessment data Art. 6(1)(b) / 6(1)(c) legal obligation (professional record-keeping duties) Art. 9(2)(h), as above
Sharing reports with third parties (e.g. GP, school) Clinical data Art. 6(1)(a) consent Art. 9(2)(a) explicit consent
Processing shop orders Order/billing data Art. 6(1)(b) contract; Art. 6(1)(c) legal obligation (tax/accounting) —
Website analytics Usage data, cookies Art. 6(1)(a) consent (via cookie banner) —
Marketing emails/newsletter Email address Art. 6(1)(a) consent —

[This table is a starting structure, not a finished legal analysis — a reviewer should confirm each basis against exactly how referrals, consent, and record-sharing actually work in this practice.]

5. Children’s data

Much of what we do involves assessing and treating children. Where the client is a child:

  • We collect and process the child’s data with the consent and involvement of a parent or legal guardian, who is treated as the primary contact for administrative and consent purposes.
  • We only collect information proportionate to providing safe, effective care.
  • Reports or data are not shared with schools, GPs, or other third parties without the consent of the parent/guardian (or another lawful basis, e.g. a child protection obligation).

6. Who we share your data with

We share personal data with:

  • Service providers who process data on our behalf (“legal processors”), including:
    • Our website host, bluehost
    • Google (Google Analytics, and Google Workspace/Gmail if used for email) — see Section 7 on international transfers
    • WooCommerce/Automattic, for shop functionality
    • Time To Talk SLT
    • Stripe
  • Other professionals involved in your care, only with consent or another lawful basis (e.g. GPs, schools, other therapists you ask us to liaise with).
  • CORU, our professional indemnity insurer, or legal/regulatory bodies, where we are legally required to disclose information.
  • Professional advisors (accountant, solicitor) where necessary for running the practice.

We do not sell personal data, and we do not share clinical data for marketing purposes.

7. International transfers

Some of our processors (for example Google and Automattic/WooCommerce) may store or process data outside the European Economic Area, including in the United States. Where this happens, we rely on the safeguards those providers have in place, such as the EU-US Data Privacy Framework or Standard Contractual Clauses.

8. How long we keep your data

Retention periods differ by the type of record:

  • Clinical and assessment records: consistent with HSE and Irish professional guidance, we retain adult clients’ records for 8 years after the conclusion of treatment, and children’s records until they turn 25 (or 26, if they were 17 at the conclusion of treatment). 
  • Shop orders and financial records: kept for 6 years, in line with Irish Revenue record-keeping requirements.
  • Website comments: currently retained indefinitely under the default WordPress setting — this should be reviewed and either time-limited or justified, consistent with the data minimisation principle.
  • Website analytics data: governed by Google Analytics’ retention settings, as configured in our account.

9. Your rights

Under GDPR, you (or, for a child client, their parent/guardian on their behalf) have the right to:

  • Access the personal data we hold about you
  • Have inaccurate data corrected
  • Request erasure of your data, subject to our legal and professional obligations to retain clinical records for the periods above
  • Restrict or object to certain processing
  • Receive a copy of data you provided to us in a portable format, where applicable
  • Withdraw consent at any time, where consent is the legal basis (this doesn’t affect processing carried out before withdrawal)

To exercise any of these rights, contact us at info@timetotalkslt.com. We may need to verify your identity before acting on a request.

10. Cookies and analytics

We use cookies, including Google Analytics, to understand how visitors use our site. Full details of what cookies we use, their purpose, and how to manage your preferences are set out in our Cookie Policy.

11. Keeping this policy up to date

We may update this policy from time to time, for example if we change providers or add new services. The “last updated” date at the top will reflect the most recent revision.

12. How to complain

If you have concerns about how we handle your data, we’d encourage you to contact us directly first at info@timetotalkslt.com so we can try to resolve it.

You also have the right to lodge a complaint with the Irish supervisory authority:

Data Protection Commission 6 Pembroke Row, Dublin 2, D02 X963, Ireland Phone: (01) 765 01 00 / 1800 437 737 Online: forms.dataprotection.ie/contact Website: dataprotection.ie